sql syntax error

drag0n

I get this error:

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'update SET site = 'paris' WHERE 1 = ''' at line 1

When I excute that statement.

$sql_update = "UPDATE update SET site = " . $textarea . " WHERE 1 = " . $id . "";

Anybody know whats wrong with that sql syntax?

DeltaRho2K

You don't need to escape your variables in your query. Try this:

$sql_update = "UPDATE update SET site = '$textarea' WHERE 1 = '$id'";

Actually, what is the 1 in your WHERE clause? If you are trying to update the update table where the specific row has an ID value of 1, then your query would go something more like one of the two following:

$sql_update = "UPDATE update SET site = '$textarea' WHERE id = '$id'";

OR

$sql_update = "UPDATE update SET site = '$textarea' WHERE id = '1'";

drag0n

yea.. but this guys column for id is Named "1"

DeltaRho2K

Then it should look like this:

$sql_update = "UPDATE update SET site = '$textarea' WHERE 1 = '$id'";

Also check to see if Register Globals is on or off in the php.ini file. If off, then you need to do something like this:

// Use this if you are using the POST method to pass the variables.
extract($_POST);

// Use this if you are using the GET method to pass the variables.
extract($_GET);

// Setup your DB connection...


// Then set and run your query
$sql_update = "UPDATE update SET site = '$textarea' WHERE 1 = '$id'";
$result = mysql_query($sql_update);

drag0n

extract?

drag0n

BTW this is my code:

first page🙂I left out db conn to make it shorter)

$sql_select ="SELECT * FROM `update` WHERE 1 = " . $_GET['id'] . ""; 
   $sql_results = mysql_query( $sql_select ) or die( mysql_error() );   

//mysql_fetch_array it 
$sql_array = mysql_fetch_array( $sql_results ); 
?>   

<form name="form1" method="post" action="actionpage.php"> 
  <textarea name="textarea" cols="50" rows="8"> <?php echo $sql_array[ "site" ]; ?> </textarea> 
  <input type="submit" name="Submit" value="Update"> 
  <input type="reset" name="Submit2" value="Reset"> 
  <input name="id" type="hidden" id="id" value="<?php echo $_GET[ "id" ]; ?>"> 
</form>

and this is actionpage.php

$sql_select ="SELECT * FROM `update` WHERE 1 = " . $_GET['id'] . ""; 
   $sql_results = mysql_query( $sql_select ) or die( mysql_error() );   

//Declare Variables 
$textarea = $_POST[ 'textarea' ];  

$id = $_POST[ 'id' ];  

//Update stuff 
$sql_update = "UPDATE update SET site = '$textarea' WHERE 1 = '$id'";  

$result_update = mysql_query( $sql_update ) or die( mysql_error() );    

   echo "You profile has been updated, thankyou for using our system";

Do you see anything wrong?

DeltaRho2K

php manual 😉

Use the extract command to get grab the variables. Pre php 4.2.0 (I think), Register Globals was on by default, and thus, they passed form variables would already be there without having to have a way to grab them. Newer php versions has it off by default, so the php won't grab variables automatically...

There are multiple ways to get the variables.

For instance:
$textarea = $_POST['textarea'];

is the same as if you just did extract($_POST);

There is a lot more to this, and I am simplifying it a bit, but if you search this forum for "Register Globals", you will find A TON of articles dealing with passing variables with Register Globals on and off...

DeltaRho2K

The code looks fin, but:

$sql_select ="SELECT * FROM `update` WHERE 1 = " . $_GET['id'] . "";  

   $sql_results = mysql_query( $sql_select ) or die( mysql_error() );    

//Declare Variables 
$textarea = $_POST[ 'textarea' ];   

$id = $_POST[ 'id' ];

In this part here, you are using both GET and POST to identify the id value... Which method are using to pass the ID variable.

Also, to clarify one thing in my previous post, if you use extract, then all of the variables you are passing will be declared all at once, so you don't need to declare them individually.

drag0n

$sql_select ="SELECT * FROM update WHERE 1 = " . $POST['id'] . "";

$sql_results = mysql_query( $sql_select ) or die( mysql_error() );

//Declare Variables
$textarea = $POST[ 'textarea' ];

$id = $_POST[ 'id' ];

//Update stuff
$sql_update = "UPDATE update SET site = '$textarea' WHERE 1 = '$id'";

$result_update = mysql_query( $sql_update ) or die( mysql_error() );

echo "You profile has been updated, thankyou for using our system";

That would be better? You dont see any other errors arround the UPDATE line? Thats where hes getting the error:
You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'update SET site = 'paris' WHERE 1 = ''' at line 1

DeltaRho2K

Well, there are a few other things that concern me...

1) The table's name is update according to your SQL code. I don't think you can do this, because UPDATE is a reserved word used in mySQL.

2) The field name of 1. I just don't think you can do that either... (maybe you can, but it isn't good practice)

3) You have a lot of white spacing throughout your code...
For example, ( $sql_select )
I would get rid of that useless white space personally. (area between the open bracket and the $ sign, and the t and the end bracket.)

Also, your $id variable is empty (look at your error). This may be because of the white space in your variable declarations, so clean those up too)